Your fal.ai API key is stored locally in ~/.canvas-maker/config.json with permissions 0600. It's never logged or sent anywhere except to fal.ai for Flux image generation.
~/.canvas-maker/config.json